Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-71434
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 3 weeks, 2 days ago Activity log
  • Created suggestion 3 weeks, 2 days ago
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

Affected products

cms
  • ==< 5.74.3
  • ==>= 6.0.0, < 6.24.2

Matching in nixpkgs

pkgs.lcms

Color management engine

  • nixos-unstable 2.18
    • nixpkgs-unstable 2.18
    • nixos-unstable-small 2.19.1
  • nixos-26.05 2.18
    • nixos-26.05-small 2.18
    • nixpkgs-26.05-darwin 2.18

pkgs.lcms1

Color management engine

  • nixos-unstable 1.19
    • nixpkgs-unstable 1.19
    • nixos-unstable-small 1.19
  • nixos-26.05 1.19
    • nixos-26.05-small 1.19
    • nixpkgs-26.05-darwin 1.19

pkgs.lcms2

Color management engine

  • nixos-unstable 2.18
    • nixpkgs-unstable 2.18
    • nixos-unstable-small 2.19.1
  • nixos-26.05 2.18
    • nixos-26.05-small 2.18
    • nixpkgs-26.05-darwin 2.18

pkgs.xcmsdb

Device Color Characterization utility for X Color Management System

pkgs.argyllcms

Color management system (compatible with ICC)

pkgs.pcmsolver

API for the Polarizable Continuum Model

Package maintainers